加载中…
PKI MCP server: inspect, verify, issue, sign X.509, CSR, CRL, OCSP, CMS, TSP, PKCS#12. 34 tools
pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving 是 ChatHome Skills 收录的 MCP 条目，来源为 Official MCP Registry，质量分 78/100。 作为 Model Context Protocol 服务器，它向 Claude、Cursor、Copilot 等兼容 MCP 的 LLM 客户端暴露可直接调用的工具，让 agent 的能力超出模型内置范围。 该条目由 ChatHome Skills 的每日抓取从官方 registry 和 GitHub 发现查询中收录，每次运行都会重新核验仓库事实、新鲜度信号和安装元数据。 质量分综合了官方 registry 收录情况、可用安装命令、许可证完整性、仓库活跃度和 GitHub star 趋势，完整算法说明见来源页。安装命令已列于上方，可直接复制使用。 在将 pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving 加入生产 agent 工作流前，请核对上方的最近更新日期和仓库状态——下方事实快照是最近一次抓取的时点值。
npx -y pkinative-mcp@1.0.0运行此命令前，请先核对上游源码。
{
"_meta": {
"io.modelcontextprotocol.registry/official": {
"status": "active",
"isLatest": true,
"updatedAt": "2026-10-17T11:30:00.265364Z",
"publishedAt": "2026-10-17T11:30:00.265364Z",
"statusChangedAt": "2026-10-17T11:30:00.265364Z"
}
},
"server": {
"name": "io.github.Nizoka/pkinative-mcp",
"_meta": {
"io.modelcontextprotocol.registry/publisher-provided": {
"com.github": {
"serverDisplayName": "pkinative MCP"
},
"io.github.nizoka.publisher": {
"tool": "mcp-publisher",
"engine": "pkinative@1.0.0",
"license": "MIT",
"network": "none",
"keywords": [
"pki",
"x509",
"certificate",
"csr",
"pkcs10",
"crl",
"ocsp",
"revocation",
"cms",
"pkcs7",
"rfc3161",
"timestamp",
"pkcs8",
"pkcs12",
"asn1",
"pem",
"der",
"oid",
"chain-validation",
"tls-certificate",
"code-signing",
"offline",
"secure-by-default",
"openssl-interop",
"ecdsa",
"ed25519",
"rsa-pss"
],
"standards": [
"RFC 5280",
"RFC 6125",
"RFC 6960",
"RFC 5652",
"RFC 3161",
"RFC 2986",
"RFC 5958",
"RFC 8018",
"RFC 7292",
"RFC 9579",
"RFC 7468"
],
"toolCount": 34,
"transports": [
"stdio",
"streamable-http"
],
"conformance": "OpenSSL 3 interoperability validated in CI (Linux and Windows)",
"keyHandling": "private keys never returned, never written, never served as resources",
"mcpProtocol": "2026-07-28",
"promptCount": 7,
"toolVersion": "1.7.9"
}
}
},
"title": "pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"version": "1.0.0",
"packages": [
{
"version": "1.0.0",
"transport": {
"type": "stdio"
},
"identifier": "pkinative-mcp",
"runtimeHint": "npx",
"registryType": "npm",
"registryBaseUrl": "https://registry.npmjs.org",
"runtimeArguments": [
{
"type": "positional",
"value": "-y",
"valueHint": "skip-confirm"
},
{
"type": "positional",
"value": "pkinative-mcp",
"valueHint": "package"
}
],
"environmentVariables": [
{
"name": "PKINATIVE_MCP_OUTPUT_DIR",
"format": "filepath",
"description": "Absolute path of the one sandbox directory: path inputs are read from it and outputMode='file' outputs are written under it (never overwritten; the real path of every file read and of every parent written must stay inside — a planted symlink or junction is SECURITY_VIOLATION). Key-bearing files (.key .p8 .p12 .pfx) are read by the key tools only, never written, never served as resources. Unset: every tool works on inline PEM / base64 only."
},
{
"name": "PKINATIVE_MCP_CACHE_DIR",
"format": "filepath",
"description": "Opt-in content-addressed response cache directory (SHA-256 keyed, 1h TTL, 256 MiB LRU, plaintext at rest). Never caches path inputs, file output, a call carrying a password or a signer, a clock-dependent instant, a random serial or nonce, describe_engine or draft_governance_issue."
},
{
"name": "PKINATIVE_MCP_PORT",
"format": "number",
"description": "Serve Streamable HTTP on this loopback port (POST /mcp) instead of stdio (MCP 2026-07-28, stateless, legacy fallback). Unauthenticated unless PKINATIVE_MCP_HTTP_TOKEN is set."
},
{
"name": "PKINATIVE_MCP_HTTP_TOKEN",
"isSecret": true,
"description": "Opt-in bearer token for the HTTP transport (>= 16 chars, no whitespace; a weaker value refuses to start). When set, /mcp requires 'Authorization: Bearer <token>' or answers 401. Compared constant-time, never logged."
},
{
"name": "PKINATIVE_MCP_PASSWORD",
"isSecret": true,
"description": "Operator-side password of the encrypted PKCS#8 key or PKCS#12 file the tools open (keeps the secret out of the model transcript). Exclusive with the per-call password input (both at once is VALIDATION_ERROR). Never logged; only its presence is reported at startup."
},
{
"name": "PKINATIVE_MCP_AT",
"description": "Pinned instant (ISO 8601 or epoch milliseconds) every omitted at / notBefore / signingTime falls back to, for reproducible verdicts and artefacts. Unset: the wall clock (a clock-dependent result is never cached). An invalid value refuses to start."
},
{
"name": "PKINATIVE_MCP_MAX_INPUT_BYTES",
"format": "number",
"description": "Operator ceiling for limits.maxInputBytes and the decoded size of one PKI object (default 67108864 = 64 MiB, the engine default). Integer >= 1024, read once at startup; an invalid value refuses to start. A per-call value above it is refused with LIMIT_CEILING_EXCEEDED."
},
{
"name": "PKINATIVE_MCP_MAX_KDF_ITERATIONS",
"format": "number",
"description": "Operator ceiling for limits.maxKdfIterations and limits.maxPkcs12KdfIterations (default 10000000, the engine default): the CPU bound of a hostile PBES2 key or PKCS#12 file. Integer >= 1, read once at startup; an invalid value refuses to start."
},
{
"name": "PKINATIVE_MCP_MAX_PATHS_EXPLORED",
"format": "number",
"description": "Operator ceiling for limits.maxPathsExplored (default 1000, the engine default): the RFC 5280 section 6 path-building work bound. Integer >= 1, read once at startup; an invalid value refuses to start."
}
]
}
],
"repository": {
"url": "https://github.com/Nizoka/pkinative-mcp",
"source": "github"
},
"websiteUrl": "https://github.com/Nizoka/pkinative-mcp#readme",
"description": "PKI MCP server: inspect, verify, issue, sign X.509, CSR, CRL, OCSP, CMS, TSP, PKCS#12. 34 tools"
}
}